1// Copyright 2014 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "content/browser/renderer_host/sandbox_ipc_linux.h"
6
7#include <fcntl.h>
8#include <sys/poll.h>
9#include <sys/socket.h>
10#include <sys/stat.h>
11
12#include "base/basictypes.h"
13#include "base/command_line.h"
14#include "base/files/scoped_file.h"
15#include "base/linux_util.h"
16#include "base/macros.h"
17#include "base/memory/scoped_vector.h"
18#include "base/memory/shared_memory.h"
19#include "base/posix/eintr_wrapper.h"
20#include "base/posix/unix_domain_socket_linux.h"
21#include "base/process/launch.h"
22#include "base/strings/string_number_conversions.h"
23#include "content/browser/renderer_host/font_utils_linux.h"
24#include "content/common/font_config_ipc_linux.h"
25#include "content/common/sandbox_linux/sandbox_linux.h"
26#include "content/common/set_process_title.h"
27#include "content/public/common/content_switches.h"
28#include "ppapi/c/trusted/ppb_browser_font_trusted.h"
29#include "third_party/WebKit/public/platform/linux/WebFontInfo.h"
30#include "third_party/WebKit/public/web/WebKit.h"
31#include "third_party/npapi/bindings/npapi_extensions.h"
32#include "third_party/skia/include/ports/SkFontConfigInterface.h"
33#include "ui/gfx/font.h"
34#include "ui/gfx/font_render_params.h"
35
36using blink::WebCString;
37using blink::WebFontInfo;
38using blink::WebUChar;
39using blink::WebUChar32;
40
41namespace content {
42
43namespace {
44
45// Converts gfx::FontRenderParams::Hinting to WebFontRenderStyle::hintStyle.
46// Returns an int for serialization, but the underlying Blink type is a char.
47int ConvertHinting(gfx::FontRenderParams::Hinting hinting) {
48  switch (hinting) {
49    case gfx::FontRenderParams::HINTING_NONE:   return 0;
50    case gfx::FontRenderParams::HINTING_SLIGHT: return 1;
51    case gfx::FontRenderParams::HINTING_MEDIUM: return 2;
52    case gfx::FontRenderParams::HINTING_FULL:   return 3;
53  }
54  NOTREACHED() << "Unexpected hinting value " << hinting;
55  return 0;
56}
57
58// Converts gfx::FontRenderParams::SubpixelRendering to
59// WebFontRenderStyle::useSubpixelRendering. Returns an int for serialization,
60// but the underlying Blink type is a char.
61int ConvertSubpixelRendering(
62    gfx::FontRenderParams::SubpixelRendering rendering) {
63  switch (rendering) {
64    case gfx::FontRenderParams::SUBPIXEL_RENDERING_NONE: return 0;
65    case gfx::FontRenderParams::SUBPIXEL_RENDERING_RGB:  return 1;
66    case gfx::FontRenderParams::SUBPIXEL_RENDERING_BGR:  return 1;
67    case gfx::FontRenderParams::SUBPIXEL_RENDERING_VRGB: return 1;
68    case gfx::FontRenderParams::SUBPIXEL_RENDERING_VBGR: return 1;
69  }
70  NOTREACHED() << "Unexpected subpixel rendering value " << rendering;
71  return 0;
72}
73
74}  // namespace
75
76SandboxIPCHandler::SandboxIPCHandler(int lifeline_fd, int browser_socket)
77    : lifeline_fd_(lifeline_fd),
78      browser_socket_(browser_socket) {
79}
80
81void SandboxIPCHandler::Run() {
82  struct pollfd pfds[2];
83  pfds[0].fd = lifeline_fd_;
84  pfds[0].events = POLLIN;
85  pfds[1].fd = browser_socket_;
86  pfds[1].events = POLLIN;
87
88  int failed_polls = 0;
89  for (;;) {
90    const int r =
91        HANDLE_EINTR(poll(pfds, arraysize(pfds), -1 /* no timeout */));
92    // '0' is not a possible return value with no timeout.
93    DCHECK_NE(0, r);
94    if (r < 0) {
95      PLOG(WARNING) << "poll";
96      if (failed_polls++ == 3) {
97        LOG(FATAL) << "poll(2) failing. SandboxIPCHandler aborting.";
98        return;
99      }
100      continue;
101    }
102
103    failed_polls = 0;
104
105    // The browser process will close the other end of this pipe on shutdown,
106    // so we should exit.
107    if (pfds[0].revents) {
108      break;
109    }
110
111    // If poll(2) reports an error condition in this fd,
112    // we assume the zygote is gone and we exit the loop.
113    if (pfds[1].revents & (POLLERR | POLLHUP)) {
114      break;
115    }
116
117    if (pfds[1].revents & POLLIN) {
118      HandleRequestFromRenderer(browser_socket_);
119    }
120  }
121
122  VLOG(1) << "SandboxIPCHandler stopping.";
123}
124
125void SandboxIPCHandler::HandleRequestFromRenderer(int fd) {
126  ScopedVector<base::ScopedFD> fds;
127
128  // A FontConfigIPC::METHOD_MATCH message could be kMaxFontFamilyLength
129  // bytes long (this is the largest message type).
130  // 128 bytes padding are necessary so recvmsg() does not return MSG_TRUNC
131  // error for a maximum length message.
132  char buf[FontConfigIPC::kMaxFontFamilyLength + 128];
133
134  const ssize_t len = UnixDomainSocket::RecvMsg(fd, buf, sizeof(buf), &fds);
135  if (len == -1) {
136    // TODO: should send an error reply, or the sender might block forever.
137    NOTREACHED() << "Sandbox host message is larger than kMaxFontFamilyLength";
138    return;
139  }
140  if (fds.empty())
141    return;
142
143  Pickle pickle(buf, len);
144  PickleIterator iter(pickle);
145
146  int kind;
147  if (!pickle.ReadInt(&iter, &kind))
148    return;
149
150  if (kind == FontConfigIPC::METHOD_MATCH) {
151    HandleFontMatchRequest(fd, pickle, iter, fds.get());
152  } else if (kind == FontConfigIPC::METHOD_OPEN) {
153    HandleFontOpenRequest(fd, pickle, iter, fds.get());
154  } else if (kind == LinuxSandbox::METHOD_GET_FALLBACK_FONT_FOR_CHAR) {
155    HandleGetFallbackFontForChar(fd, pickle, iter, fds.get());
156  } else if (kind == LinuxSandbox::METHOD_LOCALTIME) {
157    HandleLocaltime(fd, pickle, iter, fds.get());
158  } else if (kind == LinuxSandbox::METHOD_GET_STYLE_FOR_STRIKE) {
159    HandleGetStyleForStrike(fd, pickle, iter, fds.get());
160  } else if (kind == LinuxSandbox::METHOD_MAKE_SHARED_MEMORY_SEGMENT) {
161    HandleMakeSharedMemorySegment(fd, pickle, iter, fds.get());
162  } else if (kind == LinuxSandbox::METHOD_MATCH_WITH_FALLBACK) {
163    HandleMatchWithFallback(fd, pickle, iter, fds.get());
164  }
165}
166
167int SandboxIPCHandler::FindOrAddPath(const SkString& path) {
168  int count = paths_.count();
169  for (int i = 0; i < count; ++i) {
170    if (path == *paths_[i])
171      return i;
172  }
173  *paths_.append() = new SkString(path);
174  return count;
175}
176
177void SandboxIPCHandler::HandleFontMatchRequest(
178    int fd,
179    const Pickle& pickle,
180    PickleIterator iter,
181    const std::vector<base::ScopedFD*>& fds) {
182  uint32_t requested_style;
183  std::string family;
184  if (!pickle.ReadString(&iter, &family) ||
185      !pickle.ReadUInt32(&iter, &requested_style))
186    return;
187
188  SkFontConfigInterface::FontIdentity result_identity;
189  SkString result_family;
190  SkTypeface::Style result_style;
191  SkFontConfigInterface* fc =
192      SkFontConfigInterface::GetSingletonDirectInterface();
193  const bool r =
194      fc->matchFamilyName(family.c_str(),
195                          static_cast<SkTypeface::Style>(requested_style),
196                          &result_identity,
197                          &result_family,
198                          &result_style);
199
200  Pickle reply;
201  if (!r) {
202    reply.WriteBool(false);
203  } else {
204    // Stash away the returned path, so we can give it an ID (index)
205    // which will later be given to us in a request to open the file.
206    int index = FindOrAddPath(result_identity.fString);
207    result_identity.fID = static_cast<uint32_t>(index);
208
209    reply.WriteBool(true);
210    skia::WriteSkString(&reply, result_family);
211    skia::WriteSkFontIdentity(&reply, result_identity);
212    reply.WriteUInt32(result_style);
213  }
214  SendRendererReply(fds, reply, -1);
215}
216
217void SandboxIPCHandler::HandleFontOpenRequest(
218    int fd,
219    const Pickle& pickle,
220    PickleIterator iter,
221    const std::vector<base::ScopedFD*>& fds) {
222  uint32_t index;
223  if (!pickle.ReadUInt32(&iter, &index))
224    return;
225  if (index >= static_cast<uint32_t>(paths_.count()))
226    return;
227  const int result_fd = open(paths_[index]->c_str(), O_RDONLY);
228
229  Pickle reply;
230  if (result_fd == -1) {
231    reply.WriteBool(false);
232  } else {
233    reply.WriteBool(true);
234  }
235
236  // The receiver will have its own access to the file, so we will close it
237  // after this send.
238  SendRendererReply(fds, reply, result_fd);
239
240  if (result_fd >= 0) {
241    int err = IGNORE_EINTR(close(result_fd));
242    DCHECK(!err);
243  }
244}
245
246void SandboxIPCHandler::HandleGetFallbackFontForChar(
247    int fd,
248    const Pickle& pickle,
249    PickleIterator iter,
250    const std::vector<base::ScopedFD*>& fds) {
251  // The other side of this call is
252  // content/common/child_process_sandbox_support_impl_linux.cc
253
254  EnsureWebKitInitialized();
255  WebUChar32 c;
256  if (!pickle.ReadInt(&iter, &c))
257    return;
258
259  std::string preferred_locale;
260  if (!pickle.ReadString(&iter, &preferred_locale))
261    return;
262
263  blink::WebFallbackFont fallbackFont;
264  WebFontInfo::fallbackFontForChar(c, preferred_locale.c_str(), &fallbackFont);
265
266  int pathIndex = FindOrAddPath(SkString(fallbackFont.filename.data()));
267  fallbackFont.fontconfigInterfaceId = pathIndex;
268
269  Pickle reply;
270  if (fallbackFont.name.data()) {
271    reply.WriteString(fallbackFont.name.data());
272  } else {
273    reply.WriteString(std::string());
274  }
275  if (fallbackFont.filename.data()) {
276    reply.WriteString(fallbackFont.filename.data());
277  } else {
278    reply.WriteString(std::string());
279  }
280  reply.WriteInt(fallbackFont.fontconfigInterfaceId);
281  reply.WriteInt(fallbackFont.ttcIndex);
282  reply.WriteBool(fallbackFont.isBold);
283  reply.WriteBool(fallbackFont.isItalic);
284  SendRendererReply(fds, reply, -1);
285}
286
287void SandboxIPCHandler::HandleGetStyleForStrike(
288    int fd,
289    const Pickle& pickle,
290    PickleIterator iter,
291    const std::vector<base::ScopedFD*>& fds) {
292  std::string family;
293  bool bold, italic;
294  uint16 pixel_size;
295
296  if (!pickle.ReadString(&iter, &family) ||
297      !pickle.ReadBool(&iter, &bold) ||
298      !pickle.ReadBool(&iter, &italic) ||
299      !pickle.ReadUInt16(&iter, &pixel_size)) {
300    return;
301  }
302
303  EnsureWebKitInitialized();
304
305  gfx::FontRenderParamsQuery query(true);
306  query.families.push_back(family);
307  query.pixel_size = pixel_size;
308  query.style = gfx::Font::NORMAL |
309      (bold ? gfx::Font::BOLD : 0) | (italic ? gfx::Font::ITALIC : 0);
310  const gfx::FontRenderParams params = gfx::GetFontRenderParams(query, NULL);
311
312  // These are passed as ints since they're interpreted as tri-state chars in
313  // Blink.
314  Pickle reply;
315  reply.WriteInt(params.use_bitmaps);
316  reply.WriteInt(params.autohinter);
317  reply.WriteInt(params.hinting != gfx::FontRenderParams::HINTING_NONE);
318  reply.WriteInt(ConvertHinting(params.hinting));
319  reply.WriteInt(params.antialiasing);
320  reply.WriteInt(ConvertSubpixelRendering(params.subpixel_rendering));
321  reply.WriteInt(params.subpixel_positioning);
322
323  SendRendererReply(fds, reply, -1);
324}
325
326void SandboxIPCHandler::HandleLocaltime(
327    int fd,
328    const Pickle& pickle,
329    PickleIterator iter,
330    const std::vector<base::ScopedFD*>& fds) {
331  // The other side of this call is in zygote_main_linux.cc
332
333  std::string time_string;
334  if (!pickle.ReadString(&iter, &time_string) ||
335      time_string.size() != sizeof(time_t)) {
336    return;
337  }
338
339  time_t time;
340  memcpy(&time, time_string.data(), sizeof(time));
341  // We use localtime here because we need the tm_zone field to be filled
342  // out. Since we are a single-threaded process, this is safe.
343  const struct tm* expanded_time = localtime(&time);
344
345  std::string result_string;
346  const char* time_zone_string = "";
347  if (expanded_time != NULL) {
348    result_string = std::string(reinterpret_cast<const char*>(expanded_time),
349                                sizeof(struct tm));
350    time_zone_string = expanded_time->tm_zone;
351  }
352
353  Pickle reply;
354  reply.WriteString(result_string);
355  reply.WriteString(time_zone_string);
356  SendRendererReply(fds, reply, -1);
357}
358
359void SandboxIPCHandler::HandleMakeSharedMemorySegment(
360    int fd,
361    const Pickle& pickle,
362    PickleIterator iter,
363    const std::vector<base::ScopedFD*>& fds) {
364  base::SharedMemoryCreateOptions options;
365  uint32_t size;
366  if (!pickle.ReadUInt32(&iter, &size))
367    return;
368  options.size = size;
369  if (!pickle.ReadBool(&iter, &options.executable))
370    return;
371  int shm_fd = -1;
372  base::SharedMemory shm;
373  if (shm.Create(options))
374    shm_fd = shm.handle().fd;
375  Pickle reply;
376  SendRendererReply(fds, reply, shm_fd);
377}
378
379void SandboxIPCHandler::HandleMatchWithFallback(
380    int fd,
381    const Pickle& pickle,
382    PickleIterator iter,
383    const std::vector<base::ScopedFD*>& fds) {
384  std::string face;
385  bool is_bold, is_italic;
386  uint32 charset, fallback_family;
387
388  if (!pickle.ReadString(&iter, &face) || face.empty() ||
389      !pickle.ReadBool(&iter, &is_bold) ||
390      !pickle.ReadBool(&iter, &is_italic) ||
391      !pickle.ReadUInt32(&iter, &charset) ||
392      !pickle.ReadUInt32(&iter, &fallback_family)) {
393    return;
394  }
395
396  int font_fd = MatchFontFaceWithFallback(
397      face, is_bold, is_italic, charset, fallback_family);
398
399  Pickle reply;
400  SendRendererReply(fds, reply, font_fd);
401
402  if (font_fd >= 0) {
403    if (IGNORE_EINTR(close(font_fd)) < 0)
404      PLOG(ERROR) << "close";
405  }
406}
407
408void SandboxIPCHandler::SendRendererReply(
409    const std::vector<base::ScopedFD*>& fds,
410    const Pickle& reply,
411    int reply_fd) {
412  struct msghdr msg;
413  memset(&msg, 0, sizeof(msg));
414  struct iovec iov = {const_cast<void*>(reply.data()), reply.size()};
415  msg.msg_iov = &iov;
416  msg.msg_iovlen = 1;
417
418  char control_buffer[CMSG_SPACE(sizeof(int))];
419
420  if (reply_fd != -1) {
421    struct stat st;
422    if (fstat(reply_fd, &st) == 0 && S_ISDIR(st.st_mode)) {
423      LOG(FATAL) << "Tried to send a directory descriptor over sandbox IPC";
424      // We must never send directory descriptors to a sandboxed process
425      // because they can use openat with ".." elements in the path in order
426      // to escape the sandbox and reach the real filesystem.
427    }
428
429    struct cmsghdr* cmsg;
430    msg.msg_control = control_buffer;
431    msg.msg_controllen = sizeof(control_buffer);
432    cmsg = CMSG_FIRSTHDR(&msg);
433    cmsg->cmsg_level = SOL_SOCKET;
434    cmsg->cmsg_type = SCM_RIGHTS;
435    cmsg->cmsg_len = CMSG_LEN(sizeof(int));
436    memcpy(CMSG_DATA(cmsg), &reply_fd, sizeof(reply_fd));
437    msg.msg_controllen = cmsg->cmsg_len;
438  }
439
440  if (HANDLE_EINTR(sendmsg(fds[0]->get(), &msg, MSG_DONTWAIT)) < 0)
441    PLOG(ERROR) << "sendmsg";
442}
443
444SandboxIPCHandler::~SandboxIPCHandler() {
445  paths_.deleteAll();
446  if (webkit_platform_support_)
447    blink::shutdownWithoutV8();
448
449  if (IGNORE_EINTR(close(lifeline_fd_)) < 0)
450    PLOG(ERROR) << "close";
451  if (IGNORE_EINTR(close(browser_socket_)) < 0)
452    PLOG(ERROR) << "close";
453}
454
455void SandboxIPCHandler::EnsureWebKitInitialized() {
456  if (webkit_platform_support_)
457    return;
458  webkit_platform_support_.reset(new BlinkPlatformImpl);
459  blink::initializeWithoutV8(webkit_platform_support_.get());
460}
461
462}  // namespace content
463